DRUPAL-CONTRIB-2023-023
DRUPAL-CONTRIB-2023-023
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
This module enables you to define configurable GDPR alert messages. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer gdpr alert" regardless of other configurations.
Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
drupal/gdpr_alert Packagist:https://packages.drupal.org/8
- Plages de versions concernées
- ECOSYSTEM: ≥ 1.0.0, < 1.0.1
Mettez à jour vers 1.0.1